summaryrefslogtreecommitdiff
path: root/CryptoPkg
AgeCommit message (Collapse)AuthorFilesLines
2024-09-27CryptoPkg: Fix unused variable in CryptX509.cMike Beaton1-2/+1
Without this change we get: error: variable 'Index' set but not used when building on XCODE5. Co-authored-by: Savva Mitrofanov <savvamtr@gmail.com> Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
2024-09-27CryptoPkg/OpensslLib: Fix build on XCODE5Mike Beaton5-10/+10
REF: https://edk2.groups.io/g/devel/message/88179 Without this change, we get: fatal error: 'Availability.h' file not found when building on XCODE5. The workaround uses a define present in openssl/include/crypto/rand.h which modifies openssl behaviour on Apple only, causing the library to default to a non-system specific source of entropy in syscall_random() in rand_unix.c. Co-authored-by: Savva Mitrofanov <savvamtr@gmail.com> Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
2024-09-27CryptoPkg: Update generated files based on openssl 3.0.15Li Yi7-127/+25
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4842 Signed-off-by: Li Yi <yi1.li@intel.com>
2024-09-27CryptoPkg: Update openssl submodule to 3.0.15Li Yi1-0/+0
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4842 CVE-2024-6119 affects TLS-client implementation of EDK2. Fix it by updating to 3.0.15. Signed-off-by: Li Yi <yi1.li@intel.com>
2024-09-25openssl: add Library/OpensslLib/openssl to includes, drop e_os.h hackGerd Hoffmann6-5/+1
Adding $(OPENSSL_PATH)/e_os.h to the list of source files had the effect that $(OPENSSL_PATH)/ was added to the list of include directories. With the file being gone in openssl-3.2.x this doesn't work any more. Add the directory to the [Includes.Common.Private] section instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-09-25CrtLibSupport: add intptr_tGerd Hoffmann1-0/+1
Will be needed by openssl-3.4.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-09-25CrtLibSupport: add timezoneGerd Hoffmann4-1/+7
Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-09-25CrtLibSupport: add mktime()Gerd Hoffmann3-0/+31
Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-09-25CrtLibSupport: factor out EFI_TIME -> time_t calculation to new functionGerd Hoffmann1-19/+32
No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-09-25CrtLibSupport: fix gettimeofday()Gerd Hoffmann4-1/+41
Turn gettimeofday() into a proper function with return value. Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-09-25CrtLibSupport: add sleep()Gerd Hoffmann4-0/+32
Will be needed by openssl-3.2.x Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-09-23CryptoPkg/OpensslLib: Create SM3-only version of the libraryArd Biesheuvel3-0/+51
Create a special OpensslLib implementation that only exposes the SM3 routines that MbedTlsLib borrows from OpensslLib, to avoid having to pull in other parts of OpenSSL that are not needed (e.g., via the library constructor) Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2024-09-23CryptoPkg: Add unit testcase for SM3Ard Biesheuvel1-0/+11
SM3 needs to be tested so we can verify that alternative implementations (such as the one I will be contributing to BaseCryptLibMbedTls) as well as the reference implementation produce the expected value. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2024-09-23CryptoPkg/MbedTls CLANGDWARF: Replace outdated CLANG3x referencesArd Biesheuvel6-22/+6
The CLANG35 and CLANG38 toolchain specifiers have been phased out, and replaced with CLANGDWARF. Update the MbedTls library definitions accordingly. While at it, switch to the gnu99 C dialect, which is a better match with GCC in C99 mode, which includes GCC specific GNU extensions. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2024-09-13CryptoPkg: Add StackCheckLibOliver Smith-Denny2-7/+2
Remove the old stack check lib now that MdeLibs.inc includes the new one. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
2024-09-12MdePkg: Move CompilerIntrinsicsLib from ArmPkgOliver Smith-Denny2-15/+0
As per the emailed RFC in https://edk2.groups.io/g/devel/topic/rfc_move/107675828, this patch moves CompilerIntrinsicsLib from ArmPkg to MdePkg as this library provides compiler intrinsics, which are industry standard. This aligns with the goal of integrating ArmPkg into existing packages: https://bugzilla.tianocore.org/show_bug.cgi?id=4121. The newly placed CompilerIntrinsicsLib is added to MdeLibs.dsc.inc as every DSC that builds ARM/AARCH64 needs this library added. The old location is removed from every DSC in edk2 in this commit also to not break bisectability with minimal hoop jumping. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
2024-08-31CryptoPkg/BaseCryptLibMbedTls: Fix uninitialized variable errorsArd Biesheuvel2-8/+8
Clang complains about a couple of variables potentially being uninitialized, and those complaints seem to be valid. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2024-08-31CryptoPkg/OpensslLib CLANGDWARF: Use gnu99 C dialect for asm() supportArd Biesheuvel2-2/+2
'asm' is not a keyword in C99, but GCC supports it nonetheless as a GNU extension. So when using Clang, we must specify the gnu99 dialect explicitly, or inline asm blocks using asm() rather than __asm__() will be rejected by the compiler. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2024-08-29CryptoPkg: Support BrainpoolP512r1 algorithmMichael G.A. Holland2-3/+13
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4830 Allow BrainpoolP512r1 to be leveraged when the corresponding curve ID is passed to crypto libraries in EDK2 Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
2024-08-01CryptoPkg: Enable Openssl Accel builds for AARCH64Pierre Gondois2-18/+19
Enable the following modules builds for AARCH64: - OpensslLibAccel.inf - OpensslLibFullAccel.inf Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
2024-08-01CryptoPkg/OpensslLib: Add AArch64Cap for arch specific hooksPierre Gondois3-0/+109
Add AARCH64 specific implementations of: - OPENSSL_cpuid_setup(), probing hardware capabilitie (presence of FEAT_AES, etc.) - OPENSSL_rdtsc(), returning non-trusted entropy by accessing system counter. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
2024-08-01CryptoPkg/OpensslLib: Generate files for AARCH64 native supportPierre Gondois13-2/+24978
Generate AARCH64 related files and update .inf files, running: python CryptoPkg/Library/OpensslLib/configure.py Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
2024-08-01CryptoPkg/OpensslLib: Add native instruction support for AARCH64Pierre Gondois4-5/+53
Add native instruction support for AARCH64. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
2024-06-26CryptoPkg: Fix wrong comment for CryptoPkgWenxing Hou8-41/+40
Fix the wrong comment. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
2024-06-25CryptoPkg: Extend TLS handshake debug outputSebastian Witt1-3/+7
The error codes during TLS handshake errors are sometimes not enough to understand the root cause of the problem. Extending the debug output by the function and optional data helps in some cases. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
2024-06-25CryptoPkg: Add SNI extension to TLS ClientHelloSebastian Witt1-0/+18
Webservers hosting multiple websites require the TLS SNI (Server Name Indication) in the ClientHello to know which certificate to return. The current TLS code does not include the server name in the ClientHello handshake, which leads to failed HTTPS boots when the server does not return the correct certificate. This sets the host name for SNI in TlsSetVerifyHost which receives the host name also for verification against the certificates. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
2024-06-17CryptoPkg: Fix strncpy for BaseCryptLibMbedTlsWenxing Hou1-3/+22
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2817 Because the change for strncpy, add the strncpy implementation. Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
2024-06-14CryptoPkg/Test: call ProcessLibraryConstructorListGerd Hoffmann1-0/+7
Needed to properly initialize BaseRngLib. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2024-06-07CryptoPkg: Fix BaseCryptLib CrtWrapper strncpy and strcatSebastian Witt2-14/+64
Following https://bugzilla.tianocore.org/show_bug.cgi?id=2817 this bug could also apply to strncpy and strcat. For strncpy use count+1 if smaller than MAX_STRING_SIZE. This still restricts the destination size to MAX_STRING_SIZE as before but allows a strncpy when the source is close after destination without triggering the InternalSafeStringNoAsciiStrOverlap check in AsciiStrnCpyS. For strcat use the destination string length + the size of the source string including the terminator as destination size if smaller than MAX_STRING_SIZE. Also move both functions to CrtWrapper.c as they do not return the correct return value. AsciiStrnCpyS and AsciiStrCatS return RETURN_VALUE instead of a char * to the destination buffer. Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
2024-06-07CryptoPkg: Fix BaseCryptLib CrtWrapper strcpySebastian Witt1-1/+1
strcpy fails when strSource is closer than 4096 bytes after strDest. This is caused by an overlap check in AsciiStrCpyS: // // 5. Copying shall not take place between objects that overlap. // SAFE_STRING_CONSTRAINT_CHECK (InternalSafeStringNoAsciiStrOverlap (Destination, DestMax, (CHAR8 *)Source, SourceLen + 1), RETURN_ACCESS_DENIED); Since DestMax is MAX_STRING_SIZE (0x1000) and with a Source that is in this area behind Destination, AsciiStrCpyS will fail and strcpy will do nothing. When called by CRYPTO_strdup in openssl this leads to uninitialzed memory that gets accessed instead of the copied string. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2817 Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
2024-06-06CryptoPkg: Fix wrong logic in X509GetTBSCertWenxing Hou1-2/+2
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4509 Both return 0x80 value and Asn1Tag != V_ASN1_SEQUENCE are wrong return. Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
2024-06-03CryptoPkg/BaseCryptLib: Enable more functions for SMM/StandaloneMMNhi Pham1-3/+3
This facilitates RSA extension, PKCS7 sign, and bignum function to broaden the range of algorithms available in SMM/StandaloneMM for platform utilization. Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com>
2024-05-31CryptoPkg: Remove deprecated code related to SHA-1Shang Qingyu2-16/+0
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4698 The default drbg type of randlib has been switched to aes_256_ctr in openssl1.1.1, so sha1 is not really used in RandomSeed(). Remove related code which do SHA-1 support checking in CryptRand.c and CryptRandTsc.c to avoid potential compatibility errors. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Shang Qingyu <qingyu.shang@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
2024-05-31CryptoPkg: Fix bug for correct return value checking when get X509CertQingyu1-3/+3
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4509 CryptX509.c file has X509GetTBSCert() funtion and it is added Inf variable to collect the return value of ASN1_get_object(), which return 0x80 in error case. Supplement the return value check during the second function call and correct the check logic. Signed-off-by: Qingyu <qingyu.shang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
2024-05-31CryptoPkg: Add support for aes128-sha256 and aes256-sha256 cipherShang Qingyu1-0/+11
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4739 AES256-SHA256 is a Tls1.2 suite we need to support, add it to deflt_ciphers in OpensslStub. Signed-off-by: Shang Qingyu <qingyu.shang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
2024-05-27Add SM3 functions with openssl for MbedtlsWenxing Hou11-8/+1010
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Because the Mbedlts 3.3.0 doesn't have Sm3, the Sm3 implementaion is based on Openssl. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Update *.inf in BaseCryptLibMbedTlsWenxing Hou5-66/+80
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Update all *.inf in BaseCryptLibMbedTls based on new implementation. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add ImageTimestampVerify based on MbedtlsWenxing Hou1-0/+381
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Timestamp Countersignature Verification implementaion based on Mbedtls. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add AuthenticodeVerify based on MbedtlsWenxing Hou1-0/+214
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Implement AuthenticodeVerify based on Mbedtls. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add more RSA related functions based on MbedtlsWenxing Hou3-0/+770
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Implement more RSA functions such as RsaPkcs1Sign based Mbedlts. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add Pkcs5 functions based on MbedtlsWenxing Hou1-0/+100
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 PBKDF2 Key Derivation Function Wrapper Implementation over MbedTLS. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add Pkcs7 related functions based on MbedtlsWenxing Hou7-12/+2843
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Because the current Mbedlts pkcs7 library doesn't support authenticatedAttributes and only support 0 or 1 certificates in Signed data, the patch implement Pkcs7 by low Mbedtls Api. And the implementation has pass unit_tes and integration test. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add X509 functions based on MbedtlsWenxing Hou1-0/+1940
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 X.509 Certificate Handler Wrapper Implementation over MbedTLS. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add Pem APIs based on MbedtlsWenxing Hou1-0/+138
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Implement Pem API based on Mbedtls. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add rand function for BaseCryptLibMbedTlsWenxing Hou4-0/+246
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 Add rand function for BaseCryptLibMbedTls. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-05-27CryptoPkg: Add AeadAesGcm based on MbedtlsWenxing Hou1-0/+227
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177 AeadAesGcm implementation based on Mbedtls. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
2024-04-07CryptoPkg/BaseCryptLibUnitTest: add unit test functionsChris Ruffin1-71/+687
Add unit test functions: TestVerifyPkcs1v2EncryptInterface() TestVerifyRsaOaepEncryptInterface() TestVerifyEncrypt() TestVerifyDecrypt() TestVerifyEncryptDecrypt() Signed-off-by: Chris Ruffin <v-chruffin@microsoft.com> Cc: Chris Ruffin <cruffin@millcore.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Cc: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
2024-04-07CryptoPkg/Driver: add additional RSAES-OAEP crypto functionsChris Ruffin4-2/+355
Add new functions to CryptoPkg/Driver. Signed-off-by: Chris Ruffin <v-chruffin@microsoft.com> Cc: Chris Ruffin <cruffin@millcore.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Cc: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
2024-04-07CryptoPkg/BaseCryptLib: add additional RSAES-OAEP crypto functionsChris Ruffin5-50/+1054
Expand the availability of the RSAES-OAEP crypto capability in BaseCryptLib. Applications using RSA crypto functions directly from OpensslLib can transition to BaseCryptLib to take advantage of the shared crypto feature in CryptoDxe. Pkcs1v2Decrypt(): decryption using DER-encoded private key RsaOaepEncrypt(): encryption using RSA contexts RsaOaepDecrypt(): decryption using RSA contexts Fixes: https://bugzilla.tianocore.org/show_bug.cgi?id=4732 Gihub PR: https://github.com/tianocore/edk2/pull/5473 Signed-off-by: Chris Ruffin <v-chruffin@microsoft.com> Cc: Chris Ruffin <cruffin@millcore.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Cc: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
2024-04-01CryptoPkg: Remove interdependence for RsaPssVerifyHou, Wenxing1-63/+11
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4742 Remove interdependence for RsaPssVerify, only use original mbedtls API. Because APIs such as Sha512Init may be closed by the platform PCD. And this patch optimize the hash flow. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yi Li <yi1.li@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Yi Li <yi1.li@intel.com>
generated by cgit v1.1 at 2024-10-19 19:03:30 +0000